Executed+Amendment+12.pdf

CONTRACT AMENDMENT

AMENDMENT 12 to Contract between the State of North Dakota, acting through its State Procurement Office and Albertson Consulting, Inc.

The parties agree to the following terms and conditions and expressly agree that if any of the following terms and conditions conflict with any of the terms and conditions of the Contract, then, notwithstanding any term in the Contract, the following terms and conditions govern and control the rights and obligations of the parties.

Whereas Section 34. Merger and Modification of the Contract act, including the following attachments, constitutes the entire agreement between the parties. There are no understandings, agreements, or representations, oral or written, not specified within this Contract. This Contract may not be modified, supplemented or amended, in any manner, except by written agreement signed by both parties .

Participating Addendum The parties agree to remove and replace the current Participating Addendum with Participating Addendum, V1 2022. This document will be included as Attachment A to this Contract Amendment.

Renegotiation Section 6.d. Renegotiation Option states that parties may renegotiate the Contract upon mutual agreement of the parties. The parties agree to the following:

The parties agree to replace all pricing with the compensation outlined in Amendment 12

- Attachment B.

The parties agree to add the following clauses:

1. DEFINITIONS

a) Control Environment - is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization.

b) Data - means any information provided to, or collected, generated, stored, or processed by the system. Data includes user identification information and metadata which may contain Data or from which the STATE

c) Data Breach - means any access, destruction, loss, theft, use, modification or disclosure of Data by an unauthorized party or that is in violation of Contract terms and/or applicable state or federal law.

d) Data Classification - means the process of defining data into relevant categories so the information has the appropriate controls in place to protect confidentiality, integrity, and availability based on the type of information.

e) Personally Identifiable Information (PII) - information about an individual maintained by an agency, including that 1) can be used to distinguish or trace an indiv name, or biometric records; or (2) is linked or linkable to an individual, such as medical, educational, financial, and employment information.

CONTRACT NUMBER AND TITLE: #005 Professional Licensing Board Management System

AMENDMENT NUMBER: 12

f) Recovery Point Objective (RPO) - means the point in time to which Data can be recovered and/or systems restored when service is restored after an interruption. The Recovery Point Objective is expressed as a length of time between the interruption and the most proximate backup of Data immediately preceding the interruption. The RPO is detailed in the SLA.

g) Recovery Time Objective (RTO) - means the period of time within which information technology services, systems, applications and functions must be recovered following an unplanned interruption. The RTO is detailed in the SLA.

h) Software as a Service (SaaS). The capability provided to the consumer is to use the running on a infrastructure. The applications are accessible from various client devices through interfaces such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. This definition is based on and consistent with National Institute of Standards and Technology (NIST) Special Publication 800-145.

i) Users means contractors, subcontractors, outsourcing vendors, consultants and others who have a need to use the software for the benefit of STATE.

2. CYBER LIABILITY AND SECURITY INSURANCE

In the event CONTRACTOR will host data, or provide for the hosting of data through a third-party entity, CONTRACTOR shall secure and maintain Cyber Liability and Security Insurance or equivalent insurance product(s), with minimum liability limits of not less than $5,000,000 and first party limits of not less than $1,000,000, that will provide, without cost to the CONTRACTOR or STATE, an immediate response in the event of a data breach, including meeting all notification obligations of CONTRACTOR and STATE and in the event the data breach involves personal information as defined by N.D.C.C. § 51-30-1(4), the insurance policy shall also make available free credit monitoring for any affected individual for a minimum period of one year. CONTRACTOR shall defend, indemnify, save and hold harmless, the STATE, its officers, agents and employees from liability of any nature or kind, including costs and expenses, on account of a data breach arising from CONTRACTOR hosting, transmission, or control of data, any and all suits, claims, or damages of any character whatsoever, resulting from injuries or damages sustained by any person or persons or property by virtue of performance of this Contract.

3. TECHNOLOGY STANDARDS

CONTRACTOR shall comply with applicable STATE enterprise architecture technology standards. These standards can be found o http://www.nd.gov/itd/standards. If CONTRACTOR is unable to comply with any applicable standard, CONTRACTOR shall request a waiver from that requirement by submitting a Request for Exemption from Information Technology Standards or Statutory Policies (SFN review and approval or disapproval.

4. SOFTWARE AS A SERVICE (SAAS) AND SERVICE LEVEL AGREEMENT (SLA)

The terms and service level obligations are set forth in Exhibit A Software as a Service (SaaS) Service Level Agreement (SLA) are made a part of this Contract Amendment through its reference here. CONTRACTOR shall provide Subscription Services, including software/hardware updates and technical support services for the Subscription Services pursuant to this Contract.

a. Subscription Services:

1) Service shall be extended to any Users who have a need to use the SaaS for the benefit of STATE.

2) There shall be no limit on the number of machines, number of locations, or size of processors on which STATE can operate the service.

3) If CONTRACTOR reduces or replaces the functionality contained in the software and provides this functionality as a separate or renamed product, then STATE shall be entitled to usage of such software product at no additional fees.

a. Subscription Period

The subscription period begins the next month after executing the Participating Addendum.

b. Purchase of Additional Users

STATE may purchase additional Users during the term of this Contract at the same price offered by CONTRACTOR under the terms of this Contract.

c. Right to Change Support Plan Level

STATE may choose to change its subscription to C Subscription Services plan to a higher or lower level plan that is offered by CONTRACTOR at the al date upon thirty (3

d. Right to Modify or Cancel Services

STATE may choose to cancel Subscription Services at R.

5. CYBER SECURITY AUDITS

At the PARTICIP third party provider to perform cybersecurity audits and/or vulnerability and configuration assessments and scans. In the event that PARTICIPATING ENTITY elects to perform a cyber security audit, assessment, or scan, PARTICIPATING ENTITY shall give CONTRACTOR notice of said scan, and CONTRACTOR shall cooperate with said audit, assessment, and scan.

EXHIBIT A Software as a Service (SaaS) Service Level Agreement (SLA)

CONTRACTOR represents and warrants that the services will be performed in a professional manner consistent with industry standards reasonably applicable to such services.

1. SAAS AVAILABILITY:

The SaaS shall be available twenty-four (24) hours per day, 365 days per year (excluding agreed-upon scheduled maintenance downtime).

2. RESPONSE TIME SERVICE LEVEL

CONTRACTOR represents and warrants that ninety-five percent (95%) of all transactions shall process at a mutually agreed upon time threshold. STATE retains right to use a Third-or more consecutive weeks, STATE shall receive service credits in the amount of 20 percent of level for six (6) out of eight (8) consecutive weeks, CONTRACTOR shall be considered in default, and STATE may terminate the Contract without penalty.

3. RPO AND RTO

CONTRACTOR commits to a RPO of four (4) hours and RTO of twelve (12) hours. In other words, when unscheduled downtime occurs, CONTRACTOR will resume service with data matching what the system contained at some point within the four hours preceding the unscheduled downtime. Additionally, the system cannot be down for longer than twelve (12) hours during unscheduled downtime.

4. SAAS AND DATA SECURITY:

a) CONTRACTOR shall:

1) Certify the sufficiency of its security standards, tools, technologies and procedures in providing SaaS under this Contract;

2) Compliance with the following:

i. Undergo an annual Statement on Standards for Attestation Engagements (SSAE) Service Organization Control (SOC) 2 Type II audit or equivalent such as ISO 27001 for the CONTRAC Control Environment. Audit results and plan to correct any negative findings shall be provided to the STATE within seven (7) calendar days upon CO of such;

ii. Provide STATE with a detailed description of the audited Control Environment.

If STATE determines the Control Environment is not satisfactory, the STATE may request CONTRACTOR to correct any deficiencies;

3) Compliance with applicable industry standards, law, regulations and guidelines.

4) Compliance with the STATE s cyber risk program including annual assessments unless the CONTRACTOR s solution is FedRAMP, StateRAMP, or HITRUST certified.

b) CONTRACTOR shall implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with section a) above at all times during the term of this Contract to secure such Data from Data Breach, protect the Data and the SaaS from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt the STATE ess to its Data.

c) CONTRACTOR shall allow the STATE reasonable access to SaaS security logs, latency statistics, and other related SaaS security data that affect this Contract and the STATE Data, at no cost to the STATE.

d) CONTRACTOR assumes responsibility for the security and confidentiality of the Data under its control.

e) No Data shall be copied, modified, destroyed or deleted by CONTRACTOR other than for normal operation or maintenance of SaaS during the Contract period without prior written notice to and written approval by the STATE.

f) Remote access to Data from outside the continental United States, including remote access to Data by authorized SaaS support staff in identified support centers, is prohibited unless approved in advance by Chief Information Officer of the State.

5. SAAS AND ARCHITECURE:

CONTRACTOR shall provide STATE with detailed architectural diagrams on an annual basis. The architectural diagrams are to include but not limited to servers, hardware, software solution (operating system, application servers, databases, identity repository), network architecture (dataflow diagram, firewalls, proxies, IDS/IPS). CONTRACTOR shall allow the STATE reasonable access to review the architecture.

6. ENCRYPTION:

Information designated as sensitive, including PII, shall be encrypted end-to-end while it is in transit and at rest. Data must be encrypted using the most current Federal Information Processing Standard (FIPS) 140-2 validated cryptographic modules and the current Advanced Encryption Standard algorithm.

7. DATA PROCESSING AND LOCATION:

a) CONTRACTOR shall transmit, process, and store STATE Data within the continental United States.

b) CONTRACTOR shall notify STATE at least 90 days Data to a different hosting facility. STATE reserves the right to terminate the Contract without penalty if STATE does not approve of the new hosting facility.

8. RIGHTS TO DATA:

The parties agree that as between them, all rights, including all intellectual property rights, in and to Data shall remain the exclusive property of the STATE, and CONTRACTOR has a limited, non-exclusive license to access and use the Data as provided to CONTRACTOR solely for performing its obligations under the Contract. Nothing herein shall be construed to confer any license or right to the Data, including user tracking and exception Data within the system, by implication, estoppel or otherwise, under copyright or other intellectual property rights, to any third party. Unauthorized use of Data by CONTRACTOR or third parties is pro data mining or processing of data, stored or transmitted by the service, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security or service delivery analysis that is not explicitly authorized.

STATE shall have the ability to export data in partial or in entirety at its discretion without interference from the CONTRACTOR. This includes the ability for the STATE to export data to other service providers.

9. DATA BACKUP:

a) CONTRACTOR shall provide geographical disparate storage on a daily basis of all backup disks, data, or materials of any type whatsoever produced in whole or in part in connection with or related to the performance by CONTRACTOR of its obligations under this Contract (including without limitations discs, tapes, other storage media, work papers and partial drafts of documentation code).

b) CONTRACTOR shall use appropriate and reliable storage media. CONTRACTOR shall regularly backup STATE Data and retain such backup copies for a minimum of twelve

(12) months or timeframe required by applicable laws and regulations.

10. DATA RETENTION AND DISPOSAL:

a) until the STATE deletes .

b) l either securely destroy or transmit to

STATE repository any backup copies of STATE Data.

c) CONTRACTOR shall supply STATE a certificate indicating the records disposed of, the date disposed of, and the method of disposition used.

d) CONTRACTOR shall retain logs associated with STATE activity for a minimum of twelve

(12) months or timeframe required by applicable laws and regulations.

11. DATA BREACH:

a) Upon discovery or reasonable belief of any Data Breach, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in SAAS NOTICE section of this Exhibit. CONTRACTOR shall provide such notification within the lesser of twelve (12) hours or the timeframe required by applicable laws and regulations after CONTRACTOR reasonably believes there has been such a Data Breach. To the extent known at the time of notification, CONTRACTOR notice shall include:

1) The nature of the Data Breach;

2) The Data accessed, used or disclosed;

3) The person(s) who accessed, used, disclosed and/or received Data (if known);

4) What CONTRACTOR has done or will do to quarantine and mitigate the Data

Breach; and

5) What corrective action CONTRACTOR has taken or will take to prevent future

Data Breaches.

b) CONTRACTOR will provide daily updates, or more frequently if required by the STATE, regarding findings and actions performed by CONTRACTOR until the Data Breach has been effectively resolved to the satisfaction.

c) CONTRACTOR shall quarantine the Data Breach, ensure secure access to Data, and repair SaaS as needed in accordance with SLA set above in this attachment. Failure to do so may result in the STATE exercising its options for assessing damages or other remedies under this Contract.

d) CONTRACTOR shall conduct an investigation of the Data Breach and shall share the report of the investigation with the STATE. The STATE and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation.

CONTRACTOR shall cooperate fully with the STATE, its agents and law enforcement.

12. DISASTER RECOVERY/BUSINESS CONTINUITY:

a) In the event of disaster or catastrophic failure that results in significant Data loss or extended loss of access to Data, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this exhibit. CONTRACTOR shall provide such notification within twenty-four (24) hours after CONTRACTOR reasonably believes there has been such a disaster or catastrophic failure. In the notification, CONTRACTOR shall inform the STATE of:

1) The scale and quantity of the Data loss;

2) What CONTRACTOR has done or will do to recover the Data and mitigate any deleterious effect of the Data loss; and

3) What corrective action CONTRACTOR has taken or will take to prevent future

Data loss.

4) If CONTRACTOR fails to respond immediately and remedy the failure, the

STATE may exercise its options for assessing damages or other remedies under this Contract.

b) CONTRACTOR shall restore continuity of SaaS, restore Data in accordance with the RPO and RTO as set forth in the SLA, restore accessibility of Data, and repair SaaS as needed to meet the performance requirements stated in the SLA. Failure to do so may result in the STATE exercising its options for assessing damages or other remedies under this Contract.

c) CONTRACTOR shall conduct an investigation of the disaster or catastrophic failure and shall share the report of the investigation with the STATE. The STATE and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. CONTRACTOR shall cooperate fully with the STATE, its agents and law enforcement.

13. AUDIT AND EXAMINATION:

a) Upon advance written request, CONTRACTOR agrees that the STATE or its designated representative shall have access to CONTRACTOR ntation, records and databases, including online inspections, that relate to the SaaS purchased by the STATE.

b) The online inspection shall allow the STATE, its authorized agents, or a mutually acceptable third party to test that controls are in place and working as intended. Tests may include, but not be limited to, the following:

1) Operating system/network vulnerability scans,

2) Web application vulnerability scans,

3) Database application vulnerability scans, and

4) Any other scans to be performed by the STATE or representatives on behalf of the STATE.

c) After any significant Data loss or Data Breach or as a result of any disaster or catastrophic failure, CONTRACTOR will at its expense have an independent, industry-recognized, STATE-approved third party perform an information security audit. The audit results shall be shared with the STATE within seven (7) days of receipt of such results. Upon CONTRACTOR receiving the results of the audit, CONTRACTOR will provide the STATE with written evidence of planned remediation within thirty (30) days and promptly modify its security measures in order to meet its obligations under this Contract.

14. DISCOVERY:

If CONTRACTOR receives a request which may reasonably be interpreted as requiring use of the SaaS, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this Exhibit, unless prohibited by law from providing such notification. CONTRACTOR shall provide such notification within forty-eight (48) hours after CONTRACTOR receives the request. CONTRACTOR shall not respond to subpoenas, service of process, Public Records Act requests, and other legal requests directed at CONTRACTOR regarding this Contract without first notifying the STATE unless prohibited by law from providing such notification. CONTRACTOR agrees to provide its intended responses to the STATE with adequate time for the STATE to review, revise and, if necessary, seek a protective order in a court of competent jurisdiction. CONTRACTOR shall not respond to legal requests directed at the STATE unless authorized in writing to do so by the STATE.

15. SAAS NOTICE:

All notices or other communications required under this exhibit must be provided to the following:

STATE State Procurement Office CONTRACTOR State Procurement Office Dan Albertson Contract 005 CEO 600 East Boulevard Ave, Dept 012 21 Main St S Suite 100 Bismarck, ND 58505 Minot, ND 58701 701-328-2740 701-839-7523 infospo@nd.gov dan@ebigpicture.com

STATE ITD

GRC Team GRC Team 4201 Normandy Ave Bismarck, ND 58503 Phone 701-328-4470 Email cygrc@nd.gov

All other terms of the Contract remain in effect. This Contract Amendment is not effective until fully executed by all parties.

EXECUTION

CONTRACTOR STATE OF NORTH DAKOTA

Albertson Consulting, Inc.

Acting through its Office of Management and Budget, State Procurement office

BY: BY:

Dan Albertson Tricia Opp

Title: CEO IT Procurement Officer

Date: Date: